---
title: Elastic Agent inputs
description: When you configure inputs for standalone Elastic Agents, the following values are supported for the input type parameter. Expand any section to view the...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/reference/fleet/elastic-agent-inputs-list
products:
  - Elastic Agent
  - Fleet
---

# Elastic Agent inputs
When you [configure inputs](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/reference/fleet/elastic-agent-input-configuration) for standalone Elastic Agents, the following values are supported for the input `type` parameter.
**Expand any section to view the available inputs:**
<dropdown title="Audit the activities of users and processes on your systems">
  | Input                  | Description                                                                                                                                                                                                                                                              | Learn more                                                                                                                                                                     |
  |------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | `audit/auditd`         | Receives audit events from the Linux Audit Framework that is a part of the Linux kernel.                                                                                                                                                                                 | [Auditd Module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/auditbeat/auditbeat-module-auditd)Auditd Module (Auditbeat docs)                         |
  | `audit/file_integrity` | Sends events when a file is changed (created, updated, or deleted) on disk. The events contain file metadata and hashes.                                                                                                                                                 | [File Integrity Module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/auditbeat/auditbeat-module-file_integrity)File Integrity Module (Auditbeat docs) |
  | `audit/system`         | `stack: beta` `serverless: beta` Collects various security related information about a system. All datasets send both periodic state information (for example, all currently running processes) and real-time changes (for example, when a new process starts or stops). | [System Module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/auditbeat/auditbeat-module-system)System Module (Auditbeat docs)                         |
</dropdown>

<dropdown title="Collect metrics from operating systems and services running on your servers">
  | Input                   | Description                                                                                                                                                                                                                                                                                                 | Learn more                                                                                                                                                                           |
  |-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | `activemq/metrics`      | Periodically fetches JMX metrics from Apache ActiveMQ.                                                                                                                                                                                                                                                      | [ActiveMQ module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-activemq)ActiveMQ module (Metricbeat docs)                      |
  | `apache/metrics`        | Periodically fetches metrics from [Apache HTTPD](https://httpd.apache.org/)Apache HTTPD servers.                                                                                                                                                                                                            | [Apache module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-apache)Apache module (Metricbeat docs)                            |
  | `aws/metrics`           | Periodically fetches monitoring metrics from AWS CloudWatch using [GetMetricData API](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.md)GetMetricData API for AWS services.                                                                                             | [AWS module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-aws)AWS module (Metricbeat docs)                                     |
  | `awsfargate/metrics`    | `stack: beta` `serverless: beta` Retrieves various metadata, network metrics, and Docker stats about tasks and containers.                                                                                                                                                                                  | [AWS Fargate module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-awsfargate)AWS Fargate module (Metricbeat docs)              |
  | `azure/metrics`         | Collects and aggregates Azure logs and metrics from a variety of sources into a common data platform where it can be used for analysis, visualization, and alerting.                                                                                                                                        | [Azure module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-azure)Azure module (Metricbeat docs)                               |
  | `beat/metrics`          | Collects metrics about any Beat or other software based on libbeat.                                                                                                                                                                                                                                         | [Beat module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-beat)Beat module (Metricbeat docs)                                  |
  | `cloudfoundry/metrics`  | Connects to Cloud Foundry loggregator to gather container, counter, and value metrics into a common data platform where it can be used for analysis, visualization, and alerting.                                                                                                                           | [Cloudfoundry module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-cloudfoundry)Cloudfoundry module (Metricbeat docs)          |
  | `containerd/metrics`    | `stack: beta` `serverless: beta` Collects CPU, memory and blkio statistics about running containers controlled by containerd runtime.                                                                                                                                                                       | [Containerd module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-containerd)Containerd module (Metricbeat docs)                |
  | `docker/metrics`        | Fetches metrics from [Docker](https://www.docker.com/)Docker containers.                                                                                                                                                                                                                                    | [Docker module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-docker)Docker module (Metricbeat docs)                            |
  | `elasticsearch/metrics` | Collects metrics about Elasticsearch.                                                                                                                                                                                                                                                                       | [Elasticsearch module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-elasticsearch)Elasticsearch module (Metricbeat docs)       |
  | `etcd/metrics`          | This module targets Etcd V2 and V3. When using V2, metrics are collected using [Etcd v2 API](https://coreos.com/etcd/docs/latest/v2/api.md)Etcd v2 API. When using V3, metrics are retrieved from the `/metrics` endpoint as intended for [Etcd v3](https://coreos.com/etcd/docs/latest/metrics.md)Etcd v3. | [Etcd module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-etcd)Etcd module (Metricbeat docs)                                  |
  | `gcp/metrics`           | Periodically fetches monitoring metrics from Google Cloud Platform using [Stackdriver Monitoring API](https://cloud.google.com/monitoring/api/metrics_gcp)Stackdriver Monitoring API for Google Cloud Platform services.                                                                                    | [Google Cloud Platform module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-gcp)Google Cloud Platform module (Metricbeat docs) |
  | `haproxy/metrics`       | Collects stats from [HAProxy](http://www.haproxy.org/)HAProxy. It supports collection from TCP sockets, UNIX sockets, or HTTP with or without basic authentication.                                                                                                                                         | [HAProxy module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat)HAProxy module (Metricbeat docs)                                                   |
  | `http/metrics`          | Used to call arbitrary HTTP endpoints for which a dedicated Metricbeat module is not available.                                                                                                                                                                                                             | [HTTP module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-http)HTTP module (Metricbeat docs)                                  |
  | `iis/metrics`           | Periodically retrieve IIS web server related metrics.                                                                                                                                                                                                                                                       | [IIS module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-iis)IIS module (Metricbeat docs)                                     |
  | `jolokia/metrics`       | Collects metrics from [Jolokia agents](https://jolokia.org/reference/html/agents.html)Jolokia agents running on a target JMX server or dedicated proxy server.                                                                                                                                              | [Jolokia module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-jolokia)Jolokia module (Metricbeat docs)                         |
  | `kafka/metrics`         | Collects metrics from the [Apache Kafka](https://kafka.apache.org/intro)Apache Kafka event streaming platform.                                                                                                                                                                                              | [Kafka module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-kafka)Kafka module (Metricbeat docs)                               |
  | `kibana/metrics`        | Collects metrics about Kibana.                                                                                                                                                                                                                                                                              | [Kibana module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-kibana)Kibana module (Metricbeat docs)                            |
  | `kubernetes/metrics`    | As one of the main pieces provided for Kubernetes monitoring, this module is capable of fetching metrics from several components.                                                                                                                                                                           | [Kubernetes module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-kubernetes)Kubernetes module (Metricbeat docs)                |
  | `linux/metrics`         | `stack: beta` `serverless: beta` Reports on metrics exclusive to the Linux kernel and GNU/Linux OS.                                                                                                                                                                                                         | [Linux module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-linux)Linux module (Metricbeat docs)                               |
  | `logstash/metrics`      | collects metrics about Logstash.                                                                                                                                                                                                                                                                            | [Logstash module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-logstash)Logstash module (Metricbeat docs)                      |
  | `memcached/metrics`     | Collects metrics about the [memcached](https://memcached.org/)memcached memory object caching system.                                                                                                                                                                                                       | [Memcached module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-memcached)Memcached module (Metricbeat docs)                   |
  | `mongodb/metrics`       | Periodically fetches metrics from [MongoDB](https://www.mongodb.com/)MongoDB servers.                                                                                                                                                                                                                       | [MongoDB module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-mongodb)MongoDB module (Metricbeat docs)                         |
  | `mssql/metrics`         | The [Microsoft SQL 2017](https://www.microsoft.com/en-us/sql-server/sql-server-2017)Microsoft SQL 2017 Metricbeat module. It is still under active development to add new Metricsets and introduce enhancements.                                                                                            | [MSSQL module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-mssql)MSSQL module (Metricbeat docs)                               |
  | `mysql/metrics`         | Periodically fetches metrics from [MySQL](https://www.mysql.com/)MySQL servers.                                                                                                                                                                                                                             | [MySQL module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-mysql)MySQL module (Metricbeat docs)                               |
  | `nats/metrics`          | Uses the [Nats monitoring server APIs](https://nats.io/documentation/managing_the_server/monitoring/)Nats monitoring server APIs to collect metrics.                                                                                                                                                        | [NATS module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-nats)NATS module (Metricbeat docs)                                  |
  | `nginx/metrics`         | Periodically fetches metrics from [Nginx](https://nginx.org/)Nginx servers.                                                                                                                                                                                                                                 | [Nginx module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-nginx)Nginx module (Metricbeat docs)                               |
  | `oracle/metrics`        | The [Oracle](https://www.oracle.com/)Oracle module for Metricbeat. It is under active development with feedback from the community. A single Metricset for Tablespace monitoring is added so the community can start gathering metrics from their nodes and contributing to the module.                     | [Oracle module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-oracle)Oracle module (Metricbeat docs)                            |
  | `postgresql/metrics`    | Periodically fetches metrics from [PostgreSQL](https://www.postgresql.org/)PostgreSQL servers.                                                                                                                                                                                                              | [PostgresSQL module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-postgresql)PostgresSQL module (Metricbeat docs)              |
  | `prometheus/metrics`    | Periodically scrapes metrics from [Prometheus exporters](https://prometheus.io/docs/instrumenting/exporters/)Prometheus exporters.                                                                                                                                                                          | [Prometheus module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-prometheus)Prometheus module (Metricbeat docs)                |
  | `rabbitmq/metrics`      | Uses the [HTTP API](http://www.rabbitmq.com/management.html)HTTP API created by the management plugin to collect RabbitMQ metrics.                                                                                                                                                                          | [RabbitMQ module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-rabbitmq)RabbitMQ module (Metricbeat docs)                      |
  | `redis/metrics`         | Periodically fetches metrics from [Redis](http://redis.io/)Redis servers.                                                                                                                                                                                                                                   | [Redis module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-redis)Redis module (Metricbeat docs)                               |
  | `sql/metrics`           | Allows you to execute custom queries against an SQL database and store the results in Elasticsearch.                                                                                                                                                                                                        | [SQL module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-sql)SQL module (Metricbeat docs)                                     |
  | `stan/metrics`          | Uses [STAN monitoring server APIs](https://github.com/nats-io/nats-streaming-server/blob/master/server/monitor.go)STAN monitoring server APIs to collect metrics.                                                                                                                                           | [Stan module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-stan)Stan module (Metricbeat docs)                                  |
  | `statsd/metrics`        | Spawns a UDP server and listens for metrics in StatsD compatible format.                                                                                                                                                                                                                                    | [Statsd module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-statsd)Statsd module (Metricbeat docs)                            |
  | `syncgateway/metrics`   | `stack: beta` `serverless: beta` Monitor a Sync Gateway instance by using its REST API.                                                                                                                                                                                                                     | [SyncGateway module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-syncgateway)SyncGateway module (Metricbeat docs)             |
  | `system/metrics`        | Allows you to monitor your server metrics, including CPU, load, memory, network, processes, sockets, filesystem, fsstat, uptime, and more.                                                                                                                                                                  | [System module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-system)System module (Metricbeat docs)                            |
  | `traefik/metrics`       | Periodically fetches metrics from a [Traefik](https://traefik.io/)Traefik instance.                                                                                                                                                                                                                         | [Traefik module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-traefik)Traefik module (Metricbeat docs)                         |
  | `uwsgi/metrics`         | By default, collects the uWSGI stats metricset, using [StatsServer](https://uwsgi-docs.readthedocs.io/en/latest/StatsServer.html)StatsServer.                                                                                                                                                               | [uWSGI module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-uwsgi)uWSGI module (Metricbeat docs)                               |
  | `vsphere/metrics`       | Uses the [Govmomi](https://github.com/vmware/govmomi)Govmomi library to collect metrics from any Vmware SDK URL (ESXi/VCenter).                                                                                                                                                                             | [vSphere module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-vsphere)vSphere module (Metricbeat docs)                         |
  | `windows/metrics`       | Collects metrics from Windows systems.                                                                                                                                                                                                                                                                      | [Windows module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-windows)Windows module (Metricbeat docs)                         |
  | `zookeeper/metrics`     | Fetches statistics from the ZooKeeper service.                                                                                                                                                                                                                                                              | [ZooKeeper module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/metricbeat/metricbeat-module-zookeeper)ZooKeeper module (Metricbeat docs)                   |
</dropdown>

<dropdown title="Forward and centralize log data">
  | Input                | Description                                                                                                                                                                                                                                                                                 | Learn more                                                                                                                                                                                                  |
  |----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | `aws-cloudwatch`     | Stores log filesfrom Amazon Elastic Compute Cloud(EC2), AWS CloudTrail, Route53, and other sources.                                                                                                                                                                                         | [AWS CloudWatch input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-aws-cloudwatch)AWS CloudWatch input (Filebeat docs)                                    |
  | `aws-s3`             | Retrieves logs from S3 objects that are pointed to by S3 notification events read from an SQS queue or directly polling list of S3 objects in an S3 bucket.                                                                                                                                 | [AWS S3 input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-aws-s3)AWS S3 input (Filebeat docs)                                                            |
  | `azure-blob-storage` | Reads content from files stored in containers which reside on your Azure Cloud.                                                                                                                                                                                                             | [Azure Blob Storage](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-azure-blob-storage)Azure Blob Storage (Filebeat docs)                                    |
  | `azure-eventhub`     | Reads messages from an azure eventhub.                                                                                                                                                                                                                                                      | [Azure eventhub input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-azure-eventhub)Azure eventhub input (Filebeat docs)                                    |
  | `cel`                | Reads messages from a file path or HTTP API with a variety of payloads using the [Common Expression Language (CEL)](https://opensource.google.com/projects/cel)Common Expression Language (CEL) and the [mito](https://pkg.go.dev/github.com/elastic/mito/lib)mito CEL extension libraries. | [Common Expression Language input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-cel)Common Expression Language input (Filebeat docs)                       |
  | `cloudfoundry`       | Gets HTTP access logs, container logs and error logs from Cloud Foundry.                                                                                                                                                                                                                    | [Cloud Foundry input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-cloudfoundry)Cloud Foundry input (Filebeat docs)                                        |
  | `cometd`             | Streams the real-time events from a Salesforce generic subscription Push Topic.                                                                                                                                                                                                             | [CometD input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-cometd)CometD input (Filebeat docs)                                                            |
  | `container`          | Reads containers log files.                                                                                                                                                                                                                                                                 | [Container input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-container)Container input (Filebeat docs)                                                   |
  | `docker`             | Alias for `container`.                                                                                                                                                                                                                                                                      | -                                                                                                                                                                                                           |
  | `log/docker`         | Alias for `container`.                                                                                                                                                                                                                                                                      | n/a                                                                                                                                                                                                         |
  | `entity-analytics`   | Collects identity assets, such as users, from external identity providers.                                                                                                                                                                                                                  | [Entity Analytics input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-entity-analytics)Entity Analytics input (Filebeat docs)                              |
  | `event/file`         | Alias for `log`.                                                                                                                                                                                                                                                                            | n/a                                                                                                                                                                                                         |
  | `event/tcp`          | Alias for `tcp`.                                                                                                                                                                                                                                                                            | n/a                                                                                                                                                                                                         |
  | `filestream`         | Reads lines from active log files. Replaces and imporoves on the `log` input.                                                                                                                                                                                                               | [filestream input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-filestream)filestream input (Filebeat docs)                                                |
  | `gcp-pubsub`         | Reads messages from a Google Cloud Pub/Sub topic subscription.                                                                                                                                                                                                                              | [GCP Pub/Sub input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-gcp-pubsub)GCP Pub/Sub input (Filebeat docs)                                              |
  | `gcs`                | `stack: beta` `serverless: beta` Reads content from files stored in buckets which reside on your Google Cloud.                                                                                                                                                                              | [Google Cloud Storage input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-gcs)Google Cloud Storage input (Filebeat docs)                                   |
  | `http_endpoint`      | `stack: beta` `serverless: beta` Initializes a listening HTTP server that collects incoming HTTP POST requests containing a JSON body.                                                                                                                                                      | [HTTP Endpoint input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-http_endpoint)HTTP Endpoint input (Filebeat docs)                                       |
  | `httpjson`           | Read messages from an HTTP API with JSON payloads.                                                                                                                                                                                                                                          | [HTTP JSON input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-httpjson)HTTP JSON input (Filebeat docs)                                                    |
  | `journald`           | `stack: beta` `serverless: beta` A system service that collects and stores logging data.                                                                                                                                                                                                    | [Journald input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-journald)Journald input (Filebeat docs)                                                      |
  | `kafka`              | Reads from topics in a Kafka cluster.                                                                                                                                                                                                                                                       | [Kafka input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-kafka)Kafka input (Filebeat docs)                                                               |
  | `log`                | DEPRECATED: Use the `filestream` input instead.                                                                                                                                                                                                                                             | n/a                                                                                                                                                                                                         |
  | `logfile`            | Alias for `log`.                                                                                                                                                                                                                                                                            | n/a                                                                                                                                                                                                         |
  | `log/redis_slowlog`  | Alias for `redis`.                                                                                                                                                                                                                                                                          | n/a                                                                                                                                                                                                         |
  | `log/syslog`         | Alias for `syslog`.                                                                                                                                                                                                                                                                         | n/a                                                                                                                                                                                                         |
  | `mqtt`               | Reads data transmitted using lightweight messaging protocol for small and mobile devices, optimized for high-latency or unreliable networks.                                                                                                                                                | [MQTT input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-mqtt)MQTT input (Filebeat docs)                                                                  |
  | `netflow`            | Reads NetFlow and IPFIX exported flows and options records over UDP.                                                                                                                                                                                                                        | [NetFlow input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-netflow)NetFlow input (Filebeat docs)                                                         |
  | `o365audit`          | `stack: beta` `serverless: beta` Retrieves audit messages from Office 365 and Azure AD activity logs.                                                                                                                                                                                       | [Office 365 Management Activity API input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-o365audit)Office 365 Management Activity API input (Filebeat docs) |
  | `osquery`            | Collects and decodes the result logs written by [osqueryd](https://osquery.readthedocs.io/en/latest/introduction/using-osqueryd/)osqueryd in the JSON format.                                                                                                                               | -                                                                                                                                                                                                           |
  | `redis`              | `stack: beta` `serverless: beta` Reads entries from Redis slowlogs.                                                                                                                                                                                                                         | [Redis input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat)Redis input (Filebeat docs)                                                                                    |
  | `syslog`             | Reads Syslog events as specified by RFC 3164 and RFC 5424, over TCP, UDP, or a Unix stream socket.                                                                                                                                                                                          | [Syslog input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-syslog)Syslog input (Filebeat docs)                                                            |
  | `tcp`                | Reads events over TCP.                                                                                                                                                                                                                                                                      | [TCP input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-tcp)TCP input (Filebeat docs)                                                                     |
  | `udp`                | Reads events over UDP.                                                                                                                                                                                                                                                                      | [UDP input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/filebeat-input-udp)UDP input (Filebeat docs)                                                                     |
  | `unix`               | `stack: beta` `serverless: beta` Reads events over a stream-oriented Unix domain socket.                                                                                                                                                                                                    | [Unix input](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat)Unix input (Filebeat docs)                                                                                      |
  | `winlog`             | Reads from one or more event logs using Windows APIs, filters the events based on user-configured criteria, then sends the event data to the configured outputs (Elasticsearch or Logstash).                                                                                                | [Winlogbeat Overview](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/winlogbeat)Winlogbeat Overview (Winlogbeat docs)                                                                |
</dropdown>

<dropdown title="Monitor the status of your services">
  | Input             | Description                                                                                      | Learn more                                                                                                                                        |
  |-------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|
  | `synthetics/http` | Connect via HTTP and optionally verify that the host returns the expected response.              | [HTTP options](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/heartbeat/monitor-http-options)HTTP options (Heartbeat docs) |
  | `synthetics/icmp` | Use ICMP (v4 and v6) Echo Requests to check the configured hosts.                                | [ICMP options](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/heartbeat/monitor-icmp-options)ICMP options (Heartbeat docs) |
  | `synthetics/tcp`  | Connect via TCP and optionally verify the endpoint by sending and/or receiving a custom payload. | [TCP options](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/heartbeat/monitor-tcp-options)TCP options (Heartbeat docs)    |
</dropdown>

<dropdown title="View network traffic between the servers of your network">
  | Input    | Description                                                                                                                                | Learn more                                                                                                                                   |
  |----------|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|
  | `packet` | Sniffs the traffic between your servers, parses the application-level protocols on the fly, and correlates the messages into transactions. | [Packetbeat overview](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/packetbeat)Packetbeat overview (Packetbeat docs) |
</dropdown>